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Abstract 

We propose MITRA, a meta-niodel for the information flow in 
(computational) trust and reputation architectures. On an abstract 
level, MITRA describes the information flow as it is inherent in promi- 
nent trust and reputation models from the literature. We use MITRA 
to provide a structured comparison of these models. This makes it 
possible to get a clear overview of the complex research area. Further- 
more, by doing so, we identify interesting new approaches for trust and 
reputation modeling that so far have not been investigated. 
Keywords: Computational Trust, Reputation Systems, Meta Model. 



1 Introduction 

Open and decentralized systems are vulnerable to buggy or malicious agents. 
To make these systems robust against malfunction, agents need the ability 
to assess the reliability and attitudes of other agents in order to choose 
trustworthy interaction partners. To this end, a multitude of trust and 
reputation models have been and still are being proposed in the literature. 
In short, each such model generally defines all or some of the three following 
processes: how evidence about the trustworthiness of an agent is gathered, 
how this evidence is combined into a final assessment, and how this final 
assessment is used in decision-making. 

Currently, it is difficult to get an overview of what has been done in 
the area, and what needs to be done. The main reasons for this are: that 
the proposed trust and reputation models use no common terminology; that 



they are not compatible in their basic structure; and that their respective 
contributions are evaluated against different metrics. While not considering 
the last point in this article, the first two questions motivate the introduction 
of an abstract model that allows researchers to organize their models in a 
unified way. 

To this end, we propose MITRA, a meta-model for the information flow 
in computational trust and reputation architectures. MITRA formalizes and 
organizes the flow of information inside and between agents. More precisely, 
it describes the top-level processes to gather evidence, and to combine it 
with information exchanged with other agents. MITRA makes use of four 
simple concepts of information processing, namely the observation, the eval- 
uation, the fusion and the filtering of information, and abstracts away from 
numerical computations. Although being an abstract model, MITRA cap- 
tures important concepts used by existing trust and reputation models. This 
way, MITRA provides a big-picture of the trust and reputation domain and 
paves the way for a structured survey of the domain. 

The model is useful for the community in at least four respects. First, it 
serves as a terminological and structural framework to describe new models. 
Secondly, it provides a means for researchers to classify and compare existing 
approaches in this domain. In addition to this, MITRA helps to identify new 
approaches to model trust and reputation, as we will show in this article. 
Finally, it helps newcomers to get a concise overview on the structure of 
computational models of trust and reputation. 

The remainder of the article is organized as follows. In Sect. [2| we 
introduce basic concepts of trust and reputation modeling. We describe 
the MITRA model in Sect. [3| Fohowing this, in Sect. |4j we use MITRA 
to classify existing models and identify what has not yet been done in the 
research field of trust and reputation. Finally, we review related work in 
Sect. [Hand we draw conclusions in Sect. [H 

2 Basic Concepts 

In this section, we describe basic concepts and notations that are used in 
this article. 

2.1 Trust Beliefs/Intentions/ Acts and Reputation 

Following [MCOlj . we distinguish three concepts that are often confused in 
the literature: the trust belief, the trust intention and the trust act. In the 
same spirit as for the BDI architecture [ Rao96j , raw observations are at first 
evaluated and then used to form trust beliefs, which in turn, are used to 
build trust intentions. Finally, these intentions can be used as one criterion 
in the decision-making process, eventually leading to a trust or distrust act. 
Figure [T] provides a schematic view of the trust information chain. 
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Figure 1: Information Chain in Trust Reasoning. 

A basic trust belief, which we denote with tbg, reflects the view of an 
individual agent 6 on the trustworthiness of the agents T. In the common 
case, the set of agents T contains only one agent. However, trust beliefs can 
also reflect how an agent 6 thinks about a group of agents (see also |Hal021 
IFCOSj ) ; the agents belonging to the group F have to be similar in some regard 
and so, experiences with any of them may to some extent be evidence for the 
trustworthiness of the group as a whole. For example, consider several agents 
being employed by a certain company; in such a situation, the agents can be 
judged in their roles as employees of this company, and their characteristics 
can be "generalized" to other agents in the same company jFC08| . 

There is a second type of trust beliefs, which is also called "reputation" : 
a collective assessment of a group of agents about other agents (MFT+OSj . 
Here, the corresponding trust beliefs are the estimate hy an individual of 
what could be such a shared opinion of a group of agents about other 
agents F. We denote this collective trust believe by tbg). 

Each trust belief is relating to a certain context, for which it is valid. 
The context includes a particular task, and the environmental conditions, 
under which the trustee is believed (or not) to successfully carry out this 
task on behalf of the trustor. We will discuss this concept of context in 
more detail later. Now, for given trustor(s) 0, trustee(s) F and a certain 
context, there can only be one unique trust belief. This makes sure that the 
trustor cannot believe that trustee (s) F are at the same time trustworthy and 
untrustworthy concerning a context. Nevertheless, the various kinds of trust 
beliefs can still be contradictory. For example, an agent can believe that the 
agents that belong to a certain group are usually untrustworthy, but that 
a specific agent in this group is well known and believed to be trustworthy. 
The reasoning about how to deal with such situations is typically what 
occurs in another process, that does not fall into the scope of this paper. 

While trust beliefs are solely estimates about the trustworthiness of other 
agents, the process of forming trust intentions incorporates also strategic 
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considerations or characteristics of the trustee. For example, although a 
trustee believes another agent to be trustworthy, he might still be very 
pessimistic about relying on this agent. When forming trust intentions, an 
agent actually transforms trust beliefs, which are based on the past behavior 
of other agents, into its own intended future behavior towards them. This 
typically corresponds to computing the "shadow of the future" |Axe84) . 
Trust intentions of an agent a towards an agent 7, derived from sets of trust 
beliefs, are denoted by tij?^. 

2.2 Acquisition of Evidence 

Two types of information exist that can be used as input for a trust reasoning 
process. An agent can make direct observations about and evaluations of 
the behavior of other agents, and it can also receive messages from other 
agents that contain observations, evaluations or trust beliefs. 

2.2.1 Direct Observations and Evaluations 

A trust belief about an agent 7 is derived from information that provides 
evidence for 7's trustworthiness. We call such evidence an evaluation (see 
Fig. [1]). An evaluation is a subjective interpretation of a set of direct ob- 
servations about 7's behavior towards some other agent 6. In other words, 
the process of evaluation decides whether the observations are evidence for 
trustworthiness of 7. We write eval^ '^^ to denote an evaluation that is done 
by agent a concerning the behavior of agent 7 towards agent 5. Analogously, 
the direct observations made by a on an interaction between 7 and 5 are 
denoted by obs^ ''''^ . 

2.2.2 Communicated Evidence 

Besides directly acquired information, an agent can use information received 
by messages from other agents. We introduce the notation for a 

message x that is sent by agent /3 to agent a through a path of transmit- 
ters /3 (direct sender to a), . . . , ^ (initial sender). We call such a message 
communicated evidence. To ensure the correctness of the indicated path, ei- 
ther the final receiver can assess the correctness of this chain of transmitters 
(e.g., by spot-checking agents on the path and asking them whether they 
have sent the message as is), or mechanisms are put in place to prove that 
the message has indeed taken the indicated path and which intermediary 
has made which modifications (by means of cryptography, e.g., public-key 
infrastructure and signing). 

Direct observations that an agent makes on its own can only be incorrect 
if the sensors with which the observations were made are faulty. Commu- 
nicated evidence additionally can be wrong when the sender is dishonest or 
incompetent. 
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2.3 Context and Uncertainty 

Each observation, evaluation, trust belief or trust intention is in general only 
valuable if two pieces of information are attached to it: 

1. the context to which the information applies; 

2. a measure of uncertainty of the information itself. 

The concept of context is a vital part for evidence-based trust reasoning. 
|MC96j give the example that "one would trust one's doctor to diagnose and 
treat one's illness, but would generally not trust the doctor to fly one on a 
commercial airplane" . If some direct observations are made in a certain con- 
text, then this context should be annotated also to the evaluations (and the 
trust beliefs and trust intentions) that are based on these observations. As 
a result, context annotations should be propagated through the information 
chain shown in Fig. [T} 

A measure of uncertainty is needed to express how uncertain a piece of in- 
formation is believed to be. This is especially important when a trust model 
incorporates communicated evidence that may be biased or wrong. Simi- 
larly to the context information, uncertainty should be propagated through 
the whole information chain. 

3 The Meta-Model 

In this section we present MITRA, illustrated in Fig. [2j This meta-model 
organizes the different ways of how the information chain of Fig. [T] can 
be realized in an agent a's trust model. The agent can send all pieces of 
information that occur in this information chain (the square boxes in the 
Figure) to other agents; for the sake of clarity, we did not illustrate such 
actions in Fig. [2] 

On the top level, MITRA divides the trust modeling process into four 
consecutive sub-processes: 

1. observation; 

2. evaluation; 

3. fusion; 

4. decision-making. 

Let us first exemplify these sub-processes from the perspective of an 
agent a, which reasons about its trust in an agent 7. In the observation 
process, agent a tries to collect any form of evidence it can get to assess 7's 
trustworthiness. Agent a judges the direct observations (either its own or 
the communicated ones) about 7's behavior in the evaluation process. In the 
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Figure 2: Structure of MITRA for an agent a. For the sake of clarity what 
is not shown in this illustration: agent a can decide to send any piece of 
information occurring in the illustration to other agents. 



fusion process, a can use its own evaluations, and the filtered evaluations 
received from other agents, to form its trust beliefs about 7 and an image of 
other agents' trust beliefs about 7. Finally, in the decision-making process, 
a builds its trust intentions and applies them in the respective situations. 
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Below, we describe each sub-process in greater detail and then have a closer 
look at the issue of context-sensitivity. 

3.1 Observation 

During observation, agent a uses its sensors to capture information about 
other agents and the environment. In network settings for instance, sen- 
sors could be network cards, that can receive or overhear packets from the 
network. In the general case, the process of direct observation is subjec- 
tive, since different agents may use sensors that differ in certain respects, 
for instance in quality. 

As mentioned earlier, information can result from direct observation of 
the environment or be received as communicated evidence. For an observa- 
tion obso'^^ a may be the same agent as 6; in this case, a observes its own 
interaction with some other agent 7, otherwise a is observing the interac- 
tions of other agents. 

Because communicated evidence is received from other agents, a needs to 
filter the information. Communicated evidence might be incorrect for differ- 
ent reasons |CP021lBS08j . First, the communicator can intentionally provide 
wrong information, i.e., lie. For instance, the communicator might want to 
increase its own reputation or the reputation of an acquaintance; this is 
usually called "misleading propaganda" . It can also try to decrease the rep- 
utation of another competing agent, which is usually called "defamation". 
Secondly, the communicator can provide information that is not wrong but 
leads the receiver intentionally to wrong conclusions. For instance, it can 
hide information, give partial information or give out-of-context informa- 
tion. Finally, the communicator can unwittingly communicate untrue facts. 
Note that agent (3, the last agent who sent the information, needs not to be 
the originator of the information |CP02j , and therefore might alter the infor- 
mation if it is not signed. The credibility filter should take all these aspects 
into account and filter the information according to how much the sources 
of this information are intended to be trusted, more precisely, whether they 
are decided to be trusted. In Figure [2j this is indicated by the "influence" - 
arrows from "making decisions" to the credibility filters, which exactly try 
to filter out information that does not seem to be credible. 

3.2 Evaluation 

During the process of evaluation, an agent evaluates sets of direct obser- 
vations about the behavior of other agents. Such an evaluation estimates 
whether the set of observations provides evidence for the agent in ques- 
tion being trustworthy or untrustworthy. At this stage, it is not yet decided 
whether an agent is actually believed to be trustworthy or not; sets of obser- 
vations are only examined for their significance in respect to an agent's trust- 
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worthiness. In many models, this is done by comparing the actual behavior 
of an agent to what its behavior was expected to be like. This expected be- 
havior can, for instance, be determined by formal contracts |Sab02] or social 
norms |(X)TZnn[IVMTn] . Various representations are used to describe eval- 
uations: binary (e.g., |SS02j ). more fine-grained discrete (e.g., {—1,0, -t-1} 
in eBay |eBa09]), or continuous assessments (e.g., |Sabn2[ iHJSnit IVMlOj ). 

As the sets of norms and established (implicit) contracts can be subjec- 
tive, an evaluation can be subjective too. Therefore, different agents might 
contradictorily interpret the same observations as evidence for trustworthy 
and untrustworthy behavior. This is evident in the case of eBay |eBa09] 
where each human does the evaluation along his own criteria. As a con- 
sequence, an agent can try to emulate how other agents would evaluate 
observations, to eventually emulate their trust beliefs. Therefore, MITRA 
contains two different ways of evaluation (see Fig. [2|: using a's criteria, 
which results in evaluations evala'''^^; and the way a thinks Q would do the 
evaluation, which results in eval^^'''^^ 

For evaluation, it can be vital to know about the causality behind what 
happened. Indeed, if the causal relationships are not clear to the evaluating 
agent, it can wrongly evaluate a failure to be evidence for untrustworthiness, 
although it is actually an excusable failure - or vice versa [CFOOl [5E07| . 



3.3 Fusion 

In a third step, the different evaluations are /used into trust beliefs. Trust 
beliefs can be formed based on evaluations of individual agents or groups 
of agents, and can be about individuals or groups. Figure [2] shows that an 
agent a can fuse evaluations to get its own trust beliefs tb^; or to emulate 

the trust modeling of another agent 0, in order to estimate this agent's 9 's 

r (■■■) 
trust beliefs thg . In any case, if a uses evaluations eval^ received from 

another agent /3, it first needs to filter out the "incompatible" subjectivity 

inherent in the evaluations: For evaluation, /3 may have applied criteria that 

a does not agree with, or - when a is emulating the trust beliefs of - where 

a thinks that 6 would not agree with. In the figure, the check for the match 

of the applied criteria, and the potential adjustment of the evaluations, is 

named subjectivity filtering. 

The emulation of another agent 0's trust beliefs is for instance needed 
when forming reputation, i.e., trust beliefs that a certain group of agents @ 
(with 6 £ Q) would associate to a given trustee. For this, also trust beliefs 
received from other agents can be incorporated. A subjectivity filter should 
not be applied to these received trust beliefs, because reputation reflects the 
subjectivity of different agents. Still, a credibility filter is applied to avoid 
a biased reputation estimate. 

Furthermore, if an agent forms trust beliefs based on interactions where 
itself was not involved, it has to account for the relation between the inter- 
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acting agents. Assume, an agent a receives from another agent the evalua- 
tion eval^'"'\ where all four agents a, 9, 6, and 7 are distinct agents. If a 
wants to reason about (5's trustworthiness towards itself, then it first needs 
to apply a personality filter. Here, information is filtered out that contains 
no evidence for the behavior of 5 towards a, because it is specific for in- 
teractions between 6 and 7. For example, imagine that the evaluation is 
about the behavior of a mother {6) towards her child (7), and she behaved 
very trustworthy. Then this behavior does not say much about how the 
mother will behave towards another unrelated person (e.g., a). This shows 
that trustworthiness is directed, and that this direction has to be taken into 
account in trust reasoning. 

Whenever fusing sets of evaluations or trust beliefs into a single trust 
belief, it is particularly important to account for the "correlated evidence" 
problem |Pea88j . This problem arises when different evaluations or trust 
beliefs are based on the same observed interactions of agents. In other 
words, the evidence expressed by the evaluations/trust beliefs "overlaps". 
If the reasoning agent is not aware of this overlapping, certain parts of the 
evidence will wrongly be amplified and the resulting trust belief be biased. 

Many different approaches for fusing evaluations into trust beliefs (e.g., 
|WSn7[ [TPJLnHal [RRkjOT] ) . and trust beliefs into community models (e.g., 
|KSGM03l ISFR99j ) have been proposed in the literature. Most importantly, 
each trust belief should incorporate the two properties mentioned in Sect. 



2.3: the uncertainty, i.e., how strong the belief is, and in which context(s) 
it applies. 



3.4 Decision-Making 

The last component in MITRA is the decision-making process, which con- 
sists of two steps: 

1. fix trust intentions based on trust beliefs; 

2. apply the trust intentions to make the final decision to act (or not) in 
trust. 

In the first step, a set of individual and/or collective trust beliefs are used 
to derive one or several trust intentions for different contexts. Trust beliefs 
can, for instance, be aggregated into trust intentions by simply averaging 
over them, or by taking the most "pessimistic" or "optimistic" trust belief, 
etc. But also, it is possible to ignore available negative trust beliefs about 
another agent 7, and to decide to act in trust with 7 in order to give this 
agent the opportunity to rethink its behavior |FC04j . This "advance" in 
trust, which can in some cases be forgiveness, accounts for the dynamics of 
trust such as "trust begets trust" [BE89j . 
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A trust intention ti^ has to reflect two things: in which situations a 
actuahy intends to act in trust with 7 (context), and how strong the intention 
is (uncertainty). Trust intentions with these two properties can be used in 
decision-making in the same way as other criteria. Although many trust 
and reputation models from the literature do not separate the derivation 
of trust intentions from the process of decision-making, we strongly argue 
for a separation of the two processes. The reason is that the derivation of 
trust intentions is specific to trust research, while a trust intention plays in 
decision making the role of a context-sensitive criterion in the same way as 
many other criteria (like availability of a potential partner). This problem is 
however studied in depth in a research area called Multiple Criteria Decision 
Making (MCDM) |Kal06| and is not specific to trust. 

3.5 Context in MITRA 

In general, everything that can impact the behavior of a trustee and is not 
part of the trustee itself, is said to belong to the context |DeyOO| . The more 
of the available context information is considered by a trust and reputation 
model, the better the final decision can be. We propose to arrange the 
different facets of context into five classes: 

1. time (points in time or time intervals); 

2. external conditions: 

(a) physical conditions, 

(b) laws/norms, 

(c) other agents nearby; 

3. type of the delegated task; 

4. contract; 

5. information source. 

The information source is the one that provides the information, on 
which the reasoning is based, e.g., a sensor or another agent. This context 
facet is a special case, because it is not linked to a trustee's behavior. It 
is important though, since it allows an agent to have several trust beliefs 
about the same trustee, based on different information sources. 

Two different contexts can be distinguished: the one in which the in- 
formation was taken, and the one in which a decision is made {decision 
context). To fuse information that comes from different contexts, or use it 
in decision-making for different contexts, an agent needs to know how simi- 
lar the different contexts are. In the literature, many ways for representing 
context information, and similarities between contexts, have been proposed. 
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|KR03j represent context relations in form of a weighted directed graph. 
|§Y07| use ontofogies and a set of rules to represent context information. 
In a more general way, |RP07j represent context information as points in a 
multi-dimensional space, where each dimension represents one characteris- 
tic of the context (e.g., the point in time, the dollar exchange rate, etc.). 
The distance between two points in the context space, which is determined 
by some distance metric, states the similarity of the two contexts. These 
approaches have in common that an agent was given some similarity metric 
about different contexts in advance. MITRA does not assume that, and so, 
if the similarity metric cannot be known in advance, an agent needs to learn 
the metric. 

At which stage information that belongs to different contexts is eventu- 
ally fused, is up to the concrete model. However, since during this fusion 
process some information is lost, it should be done as late as possible in 
the information chain. As a consequence, that principle should generally be 
used when processing information. 

4 Organizing Existing Models 

In this section, we exemplify how existing trust and reputation (T&R) mod- 
els can be classified by means of MITRA. The approach we take here is to 
investigate which types of data are used in the considered trust models. For 
a small selection of trust models, this is shown in tables [T] and [2] Table[l]lists 
types of data that belong to the observation process. Table [2] lists the re- 
maining data types, i.e. those in the evaluation, fusion and decision-making 
processes. A check-mark indicates whether a trust model accounts for the 
respective kind of data. Still, not every model accounts for the context and 
uncertainty of the processed information. 

Additionally to this classification approach, T&R models can also be 
described by specifying: 

1. which filters are applied, 

2. where uncertainty is considered, and 

3. which facets of context are accounted for at which stage. 

Since the focus of this article lies on the meta model MITRA itself, we 
leave it to future work to provide an extensive and comprehensive classifica- 
tion using MITRA. However, as it can already be seen in the resulting tables, 
a clear picture emerges of what has been done (columns with check-marks) 
and what needs to be done in the T&R modeling domain - for example, 
there is no model with no empty columns, i.e., that uses all available types 
of information. Furthermore, the column evall*^'^^ is always empty. None of 
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the here considered trust modelqj uses the intermediate step of simulating 
the evaluation of another agent to eventually form a collective trust belief 
(reputation). However, we believe that this is something what humans do 
regularly; for example in form of questions like "What would my mother 
think about his behavior?" or "How would my best friend judge this agent's 
behavior?". This issue deserves more attention as it makes it possible to 
evaluate the behavior of other agents in cases where an own opinion on 
their behavior is lacking. 

5 Related Work 

Numerous survey or overview papers on trust and reputation models have 
been published. Many works start with a basic classification and then 
enumerate and describe existing models |SMS05l IAG071 IJ1B07L IRHJ041 
IMHMn2j . Opposed to that, we tried in our work to use a rigorous method- 
ology for the organization of the state of the art: extract the core structure 
of prominent trust and reputation models, in order to get clear and simple 
differentiation criteria for the models of the literature. 

|KBR05] proposed a generic trust model that integrates several existing 
trust models. They show how to map each of these models to their model. 
However, they focus on the fusion of evaluations, whereas we examined the 
overall structure of trust and reputation modeling. 

|CS05j define a functional ontology of reputation, that is used in different 
systems |V(]SBn7[ INBSVnSj in order to help agents using different trust 
and reputation models inter-operate. These approaches try to cope with a 
situation where different models exist, whereas we try to propose a unified 
meta-model of trust and reputation. 

6 Conclusion 

In this article, we presented MITRA, a meta-model for trust and reputation. 
The model structures many essential concepts found in the literature on 
evidence-based T&R models. The simple and generic structure of MITRA 
makes it suitable both for experts to organize their models in a common 
way, and for newcomers to easily enter the domain. Although there is the 
possibility that a specific T&R model does not comply with MITRA, the 
fact that the latter was derived from the study of many existing models 
argues for its comprehensiveness, and we believe that its modularity should 
make it simple to modify in order to encompass new elements. 

Finally, by using MITRA, we classified existing T&R models from the 
literature. This classification revealed which kinds of information are com- 

'^To our knowledge there is no such trust model in the literature. 
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monly used by these models, and which kinds of information are often ne- 
glected. In this way, wc found that none of the considered models actually 
tries to emulate another agent's evaluation of a trustee; this emulation would 
make it possible to form the reputation of an agent in a new way. 
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